Retain bring-your-own Anthropic key as a Pro option

[PAMulligan]

Description

Keep the existing bring-your-own-key (BYO) path as a Pro-only option. A Pro user can choose to supply their own OpenAI key, in which case requests use their key (no metering against our quota) instead of the hosted proxy. Free users always use the metered hosted proxy.

Today BYO key is the only path: the key is stored in chrome.storage.local and used directly by app/src/lib/openai.ts. This issue repositions that as a Pro power-user feature rather than the default.

Why

Some power users prefer their own key for cost control, higher limits, or model choice, and it costs us nothing to serve them. Offering it to Pro preserves a feature early adopters already rely on, gives Pro extra value, and reduces our AI bill. Restricting it to Pro avoids a loophole where free users bypass metering entirely.

Acceptance Criteria

• BYO-key entry visible and usable only for Pro (gated by entitlement)
• When a Pro user supplies a key, requests use it directly and skip our quota
• Toggle between "use my key" and "use Optia's AI" with clear current-state indication
• Key stored locally only, never sent to our backend
• Invalid/revoked key surfaces a clear error and falls back gracefully
• Free users cannot reach the BYO-key path
• Tests for Pro-with-key, Pro-without-key, and free cases
• CI passes

Resources

• app/src/lib/openai.ts and app/src/lib/storage.ts (current BYO-key handling)
• Depends on: AI proxy (Build the hosted AI proxy with usage metering and rate limits #7), feature gating (Define and implement free vs Pro feature gating #9)

[PAMulligan]

Decision (2026-07-19): Anthropic-only, direct-to-provider. Two updates to this issue's premise:

1. BYO is a bring-your-own-Anthropic key (the product no longer touches OpenAI anywhere; the hosted proxy serves Claude).
2. "Key stored locally only, never sent to our backend" is now enforced server-side: the backend's Authorization passthrough was removed (PMDevSolutions/optia-backend#17), so the proxy never reads a caller key. BYO mode means the extension calls the Anthropic Messages API directly with the user's key — browser calls need Anthropic's anthropic-dangerous-direct-browser-access CORS opt-in and an api.anthropic.com host permission in the manifest.

Client contract details are in the backend design record (docs/plans/2026-07-19-byo-direct-to-provider.md) and #22.